[CONTINT-3684] allow communication with dca for sidecar and customising sidecar container image

[adel121]

trafficstars

What does this PR do?

This PR allows adding users have more fine-grained customisation on he sidecar injection feature by allowing:

• disabling/enabling communication between injected sidecar and the cluster-agent (enabled and configured by default)
• setting custom container_registry, image_name or image_tag to set a specific image for the agent sidecar

Motivation

Allow users to further customise injected sidecar.

Additional Notes

Possible Drawbacks / Trade-offs

Describe how to test/QA your changes

Same QA as this PR, but:

• set image configs for sidecar image by setting the following env vars on the cluster agent and make sure the sidecar image is constructed based on these env vars:
  • DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_CONTAINER_REGISTRY
  • DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_NAME
  • DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_TAG
• ensure agent sidecar can communicate with the cluster agent
• ensure you can disable communication with the cluster agent

You can make use of the following setup:

• helm installation:

datadog:
  apiKeyExistingSecret: datadog-secret
  appKeyExistingSecret: datadog-secret
  kubelet:
    tlsVerify: false

agents:
  enabled: false

clusterAgent:
  enabled: true
  admissionController:
    enabled: true
  env:
    - name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_ENABLED
      value: "true"
    - name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_PROVIDER
      value: "fargate"
    - name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_CONTAINER_REGISTRY
      value: "my-registry"
    - name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_NAME
      value: "my-image"
    - name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_IMAGE_TAG
      value: "my-tag"

    - name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_SELECTORS
      value: '[{"ObjectSelector": {"MatchLabels": {"injectSidecarPodLabel": "true"}}, "NamespaceSelector": {"MatchLabels": {"injectSidecarNs": "true"}}}]'
    - name: DD_ADMISSION_CONTROLLER_AGENT_SIDECAR_PROFILES
      value: |
        [{
        "env": [
            {"name": "ENV_VAR_1", "value": "value1"}
        ],
        "resources": {
            "limits": {
                "cpu": "1",
                "memory": "512Mi"
            },
            "requests": {
                "cpu": "0.5",
                "memory": "256Mi"
            }
        }}]

• Create a namespace that matches the selector:

apiVersion: v1
kind: Namespace
metadata:
  name: ns-for-qa
  labels:
    injectSidecarNs: "true"

Create the following service account, clusterrole and clusterrolebinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: datadog-agent
rules:
  - apiGroups:
      - ""
    resources:
      - nodes
      - namespaces
      - endpoints
    verbs:
      - get
      - list
  - apiGroups:
      - ""
    resources:
      - nodes/metrics
      - nodes/spec
      - nodes/stats
      - nodes/proxy
      - nodes/pods
      - nodes/healthz
    verbs:
      - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: datadog-agent
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: datadog-agent
subjects:
  - kind: ServiceAccount
    name: datadog-agent
    namespace: default
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: datadog-agent
  namespace: default

Add the generated cluster agent authentication token to the datadog-secret secret:

• Get the token first:

kubectl get secret datadog-agent-cluster-agent -o yaml 

....
apiVersion: v1
data:
  token: TlhCVVNEdUpOaDlSM3FQQ2d0cnBpVWowYVBDZXM4NEQ=
kind: Secret
....

• Add it in datadog-secret:

kubectl edit secret datadog-secret

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
  api-key: YzA4ZDk3NjgwNzIzYTQ3MDEyMTJmODMzOTRhY2E1M2Y=
  token: TlhCVVNEdUpOaDlSM3FQQ2d0cnBpVWowYVBDZXM4NEQ=
  app-key: MWU5MjY3ODA3ZWZhMzYwMTYxMDgyNmE0MTg1ODMyM2VlYjJlODVkZQ==

Copy the datadog secret from the default namespace to the ns-for-qa namespace:

kubectl get secret datadog-secret -n default -o yaml | sed -e 's/namespace: default/namespace:  ns-for-qa/' | kubectl apply -f -

Create a pod matching the selectors:

apiVersion: v1
kind: Pod
metadata:
  name: sample-pod
  namespace: ns-for-qa
  labels:
    admission.datadoghq.com/enabled: "false"
    injectSidecarPodLabel: "true"
spec:
  containers:
    - name: nginx
      image: nginx:1.14.2
      ports:
        - containerPort: 80

• Ensure the agent sidecar is injected with the correct image and cluster agent env vars:

kubectl get pod sample-pod -n ns-for-qa -o yaml

....
- env:
    - name: DD_API_KEY
      valueFrom:
        secretKeyRef:
          key: api-key
          name: datadog-secret
    - name: DD_SITE
      value: datadoghq.com
    - name: DD_CLUSTER_NAME
    - name: DD_KUBERNETES_KUBELET_NODENAME
      valueFrom:
        fieldRef:
          apiVersion: v1
          fieldPath: spec.nodeName
    - name: DD_CLUSTER_AGENT_ENABLED
      value: "true"
    - name: DD_CLUSTER_AGENT_AUTH_TOKEN
      valueFrom:
        secretKeyRef:
          key: token
          name: datadog-agent-cluster-agent
    - name: DD_CLUSTER_AGENT_URL
      value: https://datadog-agent-cluster-agent.default.svc.cluster.local:5005
    - name: DD_ORCHESTRATOR_EXPLORER_ENABLED
      value: "true"
    - name: DD_EKS_FARGATE
      value: "true"
    - name: ENV_VAR_1
      value: value1
    image: datadog/agent:latest
    imagePullPolicy: IfNotPresent
    name: datadog-agent-injected
    resources:
      limits:
        cpu: "1"
        memory: 512Mi
      requests:
        cpu: 500m
        memory: 256Mi
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-84c9r
      readOnly: true
....

Finally ensure the agent sidecar can connect successfully to the cluster agent:

kubectl exec sample-pod -c datadog-agent-injected -n ns-for-qa -- agent status

....
=====================
Datadog Cluster Agent
=====================

  - Datadog Cluster Agent endpoint detected: https://datadog-agent-cluster-agent.default.svc.cluster.local:5005/
  Successfully connected to the Datadog Cluster Agent.
  - Running: 7.52.0-devel+git.648.ff59345.commit.ff59345856
....

[pr-commenter[bot]]

Bloop Bleep... Dogbot Here

Regression Detector Results

Run ID: fd4d2eba-ecf6-4b74-9a73-6612bab857ab Baseline: 183552909078bf6198e2c6d2fa6315cfd0d740df Comparison: 3acf2e78a01dd933992ea7e2e1fdc616a6d28fc2 Total CPUs: 7

Performance changes are noted in the perf column of each table:

• ✅ = significantly better comparison variant performance
• ❌ = significantly worse comparison variant performance
• ➖ = no significant change in performance

Experiments with missing or malformed data

• basic_py_check

Usually, this warning means that there is no usable optimization goal data for that experiment, which could be a result of misconfiguration.

No significant changes in experiment optimization goals

Confidence level: 90.00% Effect size tolerance: |Δ mean %| ≥ 5.00%

There were no significant changes in experiment optimization goals at this confidence level and effect size tolerance.

Experiments ignored for regressions

Regressions in experiments with settings containing erratic: true are ignored.

perf	experiment	goal	Δ mean %	Δ mean % CI
➖	file_to_blackhole	% cpu utilization	+2.29	[-4.38, +8.96]

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI
➖	file_to_blackhole	% cpu utilization	+2.29	[-4.38, +8.96]
➖	process_agent_real_time_mode	memory utilization	+0.58	[+0.55, +0.61]
➖	process_agent_standard_check	memory utilization	+0.34	[+0.30, +0.38]
➖	idle	memory utilization	+0.16	[+0.12, +0.20]
➖	file_tree	memory utilization	+0.08	[+0.00, +0.16]
➖	trace_agent_json	ingress throughput	+0.00	[-0.01, +0.01]
➖	uds_dogstatsd_to_api	ingress throughput	+0.00	[-0.00, +0.00]
➖	tcp_dd_logs_filter_exclude	ingress throughput	+0.00	[-0.00, +0.00]
➖	trace_agent_msgpack	ingress throughput	-0.00	[-0.02, +0.01]
➖	process_agent_standard_check_with_stats	memory utilization	-0.20	[-0.24, -0.17]
➖	tcp_syslog_to_blackhole	ingress throughput	-0.33	[-0.41, -0.25]
➖	otel_to_otel_logs	ingress throughput	-1.10	[-1.69, -0.51]
➖	uds_dogstatsd_to_api_cpu	% cpu utilization	-3.35	[-4.73, -1.97]

Explanation

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:

1. Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.

2. Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.

3. Its configuration does not mark it "erratic".

[adel121]

/merge

[dd-devflow[bot]]

:steam_locomotive: MergeQueue

This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals. Note: if you pushed new commits since the last approval, you may need additional approval. You can remove it from the waiting list with /remove command.

Use /merge -c to cancel this operation!

[adel121]

/merge -c

[dd-devflow[bot]]

:warning: MergeQueue

This merge request was unqueued

If you need support, contact us on Slack #ci-interfaces!

[adel121]

/merge

[dd-devflow[bot]]

:steam_locomotive: MergeQueue

This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals. Note: if you pushed new commits since the last approval, you may need additional approval. You can remove it from the waiting list with /remove command.

Use /merge -c to cancel this operation!

[adel121]

/merge -c

[dd-devflow[bot]]

:warning: MergeQueue

This merge request was unqueued

If you need support, contact us on Slack #ci-interfaces!

[adel121]

/merge

[dd-devflow[bot]]

:steam_locomotive: MergeQueue

This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals. Note: if you pushed new commits since the last approval, you may need additional approval. You can remove it from the waiting list with /remove command.

Use /merge -c to cancel this operation!

[dd-devflow[bot]]

:warning: MergeQueue

This merge request was unqueued

If you need support, contact us on Slack #ci-interfaces!

[adel121]

/merge

[dd-devflow[bot]]

:steam_locomotive: MergeQueue

This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals. Note: if you pushed new commits since the last approval, you may need additional approval. You can remove it from the waiting list with /remove command.

Use /merge -c to cancel this operation!

[dd-devflow[bot]]

:steam_locomotive: MergeQueue

Added to the queue.

This build is going to start soon! (estimated merge in less than 47m)

Use /merge -c to cancel this operation!